Kim - The Hacker Playbook: Practical Guide To Penetration Testing

THE

HACKER

PLAYBOOK

Practical Guide To
Penetration Testing

Copyright 2014 by Secure Planet LLC. All rights reserved. Except as permitted under United States Copyright Act of 1976, no part of this publication may be reproduced or distributed in any form or by any means, or stored in a data base or retrieval system, without the prior written permission of the author.

ISBN: 1494932636

ISBN 13: 9781494932633

Library of Congress Control Number: 2014900431

CreateSpace Independent Publishing Platform

North Charleston, South Carolina

MHID:

Book design and production by Peter Kim, Secure Planet LLC

Cover design by Dit Vannouvong

Publisher: Secure Planet LLC

Published: 1st January 2014

I didnt start one day to think that Id write a book about penetration testing, but I kind of fell into it. What happened was I started taking notes from penetration tests, conferences, security articles, research, and life experiences. As my notes grew and grew, I found better and better ways to perform repetitive tasks and I began to understand what worked and what didnt.

As I began to teach, speak at conferences, and get involved in the security community, I felt that the industry could benefit from my lessons learned. This book is a collection of just that. One important thing I want to point out is that I am not a professional writer, but wrote this book as a hobby. You may have your own preferred tools, techniques and tactics that you utilize, but that is what makes this field great. There are often many different answers to the same question and I invite you to explore them all. I wont be giving a step-by-step walkthrough of every type of attack; so its your job to continually do research, try differently methods, and see what works for you.

This book assumes that you have some knowledge of common security tools, have used a little Metasploit, and keep up somewhat with the security industry. You dont have to be a penetration tester to take full advantage of the book; but it helps if your passion is for security.

My purpose in writing this book is to create a straightforward and practical approach to penetration testing. There are many security books that discuss every type of tool and every type of vulnerability, where only small portions of the attacks seem to be relevant to the average penetration tester. My hope is that this book will help you evolve your security knowledge and better understand how you need to protect your own environment.

Throughout the book, Ill be going into techniques and processes that I feel are real world and part of a typical penetration engagement. You wont always be able to use these techniques exactly as shown, but they should help provide a good baseline for where you should start.

I will conclude with some advice that I have found to be helpful. To become a better security professional, some of the most important things to do are:

These pointers represent a continual lifecycle, which will help you evolve in your technical maturity. Thanks again for reading this book and I hope you have as much fun reading it as I had writing it.

Hunched over your keyboard in your dimly lit room, frustrated, possibly on one too many energy drinks, you check your phone. As you squint from the glare of the bright LCD screen, you barely make out the time to be 3:00 a.m. Great, you think to yourself. You have 5 more hours before your test is over and you havent found a single exploit or critical vulnerability. Your scans were not fruitful and no ones going to accept a report with a bunch of Secure Flag cookie issues.

You need that Hail Mary pass, so you pick up The Hacker Playbook and open to the section called The Throw - Manual Web Application Findings. Scanning through, you see that youve missed testing the cookies for SQL injection attacks. You think, This is something that a simple web scanner would miss. You kick off SQLMap using the cookie switch and run it. A couple of minutes later, your screen starts to violently scroll and stops at:

Web server operating system: Windows 2008

web application technology: ASP.net, Microsoft IIS 7.5

back and DBMS: Microsoft SQL Server 2008

Perfect. You use SQLMap to drop into a command shell, but sadly realize that you do not have administrative privileges. What would be the next logical step? I wish I had some post-exploitation tricks up my sleeve, you think to yourself. Then you remember that this book could help with that. You open to the section The Lateral Pass - Moving through the Network and read up and down. There are so many different options here, but lets see if this host is connected to the domain and if they used Group Policy Preferences to set Local Administrators.

Taking advantage of the IEX Power Shell command, you force the server to download Power Sploits GPP script, execute it, and store the results to a file. Looks like it worked without triggering Anti-Virus! You read the contents of the file that the script exported and lo and behold, the local administrative password.

The rest is history you spawn a Meterpreter shell with the admin privileges, pivot through that host, and use SMBexec to pull all the user hashes from the Domain Controller.

Of course, this was all a very quick and high-level example, but this is how I tried to layout the book. There are 10 different sections to this book, laid out as a football playbook. The 10 sections are:

Before we dig into how to attack different networks, pivot through security controls, and evade AV, I want to get you into the right mindset. Imagine you have been hired as the penetration tester to test the overall security of a Fortune 500 company. Where do you start? What are you your baseline security tests? How do you provide consistent testing for all of your clients and when do you deviate from that line? This is how I am going to deliver the messages of this book.